On July 1, 2024, the HHS Office of Civil Rights (OCR) announced that Pennsylvania-based healthcare system, Heritage Valley Health System (Heritage Valley), has agreed to pay $950,000 to settle potential violations of the HIPAA Privacy, Security, and Breach Notification Rules. In addition, Heritage Valley agreed to a corrective action plan (CAP) to address alleged gaps in its HIPAA compliance program. The settlement with Heritage Valley is the third HIPAA enforcement action by HHS in a case involving ransomware.

The settlement stems from a global ransomware cyber-attack that occurred in 2017. HHS opened a compliance review after the media reported that Heritage Valley experienced a data security incident. HHS conducted a comprehensive investigation into Heritage Valley’s compliance with HIPAA. This investigation found several alleged potential violations of HIPAA, including:

• Failure to conduct an accurate and thorough risk analysis to determine risks and vulnerabilities to electronic PHI (ePHI) across the organization;
• Failure to implement a contingency plan to respond to emergencies, like a ransomware attack, that damage systems that contain ePHI; and
• Failure to implement policies and procedures to allow only authorized users access to ePHI.

In addition to agreeing to pay $950,000 for the alleged HIPAA violations, Heritage Valley agreed to implement a CAP in which OCR will monitor Heritage Valley for three years to ensure compliance with HIPAA. The agreed upon CAP will require Heritage Valley to make the following corrective measures:

• Conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI;
• Implement a risk management plan to address and mitigate security risks and vulnerabilities identified in their risk analysis;
• Review and develop, maintain, and revise, as necessary its written policies and procedures to comply with the HIPAA Rules; and
• Train its workforce on its HIPAA policies and procedures.

Ransomware breaches continue to be a top enforcement priority for OCR. According to OCR, there has been a 264% increase since 2018 in large breaches reported to OCR involving ransomware attacks.

The Resolution Agreement and Corrective Action Plan can be found here. The OCR Press Release regarding the Resolution Agreement can be found here.